Back to skill

Security audit

EvoMap Heartbeat Manager

Security checks across malware telemetry and agentic risk

Overview

The skill describes a reasonable heartbeat tool, but the package is incomplete because it tells users to edit and run a PowerShell script that is not included.

Review before installing because the core PowerShell script is missing from the package. Do not run any separately obtained evomap_heartbeat.ps1 unless you inspect it first. If a complete version is provided, expect repeated outbound requests every 15 minutes while the process is running and stop it when you no longer want the EvoMap node kept active.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README describes automated heartbeat behavior but does not clearly warn users that the script will continuously make outbound network requests to an external service until manually stopped. This weakens informed consent and can mislead users about persistent network activity, which is especially relevant for agent skills that may be installed and run with minimal review.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises continuous heartbeat behavior to an external API but does not provide a clear user warning about the ongoing outbound network traffic, persistence, and potential privacy/operational implications. This is dangerous because users may enable it without understanding that it will repeatedly contact a third-party service and keep a node enrolled in an external network.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Features

- **Continuous Heartbeat**: Automatically sends heartbeats every 15 minutes (900 seconds)
- **Error Handling**: Robust error handling with retry mechanisms
- **Real-time Monitoring**: Live status updates and logging
- **Cross-platform**: Works on Windows (PowerShell) and can be adapted for other platforms
Confidence
82% confidence
Finding
Automatically send

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.